
from stix.core import STIXPackage
from stix.indicator import Indicator
from stix.indicator import Indicator, CompositeIndicatorExpression
from cybox.objects.address_object import Address



pkg2 = STIXPackage()
pkg2.title="Example of Indicator Composition for a one of many indicator composition"

# create container indicator
watchlistind = Indicator()
watchlistind.add_indicator_type("IP Watchlist")
watchlistind.description = "This Indicator specifies a pattern where any one or more of a set of three IP addresses are observed."
# watchlistind.add_indicated_ttp(TTP(idref=c2_ttp.id_))
# Create composite expression
watchlistind.composite_indicator_expression = CompositeIndicatorExpression()
watchlistind.composite_indicator_expression.operator = "OR"

with open('ips') as f:
    for ip in f:
        new_ind = Indicator()
        new_ind.description = "This Indicator specifies a pattern where one specific IP address is observed"
        # add network network connection to this indicator
        obs = Address()
        obs.address_value = ip
        obs.address_value.condition = "Equals"
        new_ind.add_observable(obs)
        # new_ind.add_indicated_ttp(TTP(idref=c2_ttp.id_))
        watchlistind.composite_indicator_expression.append(new_ind)

pkg2.add_indicator(watchlistind)
print pkg2.to_xml()

